Riskcovery

CVE-2025-67850

Moodle: moodle: cross-site scripting vulnerability via inadequate input filtering in formula editor

State
Published
Severity
7.3 High
Published
Feb 3, 2026
Updated
Feb 26, 2026
Reserved
Dec 12, 2025

Read the record on cve.org

Description

A flaw was found in moodle. This vulnerability, known as Cross-Site Scripting (XSS), occurs due to insufficient checks on user-provided data in the formula editor's arithmetic expression fields. A remote attacker could inject malicious code into these fields. When other users view these expressions, the malicious code would execute in their web browsers, potentially compromising their data or leading to unauthorized actions.

Scores

CVSSScoreVectorSource
3.17.3 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:Nfedora

Weaknesses

  • CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected Products

ProductVersions
moodle
  • 4.1.0 to before 4.1.22Affected
  • 4.4.0 to before 4.4.12Affected
  • 4.5.0 to before 4.5.8Affected
  • 5.0.0 to before 5.0.4Affected
  • 5.1.0 to before 5.1.1Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.